Website Security Review

New review

Target

HTTP/HTTPS only

Scanner is fail-closed. Configure SCANNER_ALLOWED_HOSTS, or explicitly set SCANNER_ALLOW_ANY_PUBLIC=1 only after adding authentication.

Website URL

Scan profile PassiveDNS, TLS, HSTS/CSP/security headers, cookies, CORS, public HTML structure and metadata, and security.txt. Authorized discovery Adds common exposure probes plus OPTIONS and TRACE checks. No injection, brute force, port scan, or exploit. Warning: WAF, IDS, CDN, or hosting controls may interpret these requests as hostile and temporarily block or reputation-list our scanner IP.

Normalized findings—not page bodies or cookie values—are sent to OpenAI for report writing when an API key is configured. API requests use store: false.

What this does not prove

Black-box automation cannot establish secure authorization, authentication, business logic, source code, dependencies, cloud configuration, or authenticated API behavior. Report marks these areas Not tested instead of guessing.

Website security review

Target

Waiting for worker

Checks

What this does not prove

Target

Waiting for worker

Checks

Technical report

What this does not prove